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Abstract 

One of the earliest quantum algorithms was discovered by Bernstein and Vazirani, for a problem called 
Recursive Fourier Sampling. This paper shows that the Bernstein- Vazirani algorithm is not far from 
optimal. The moral is that the need to "uncompute" garbage can impose a fundamental limit on efficient 
quantum computation. The proof introduces a new parameter of Boolean functions called the "nonparity 
coefficient," which might be of independent interest. 

Like a classical algorithm, a quantum algorithm can solve problems recursively by calling itself as a sub- 
routine. When this is done, though, the algorithm typically needs to call itself twice for each subproblem to 
be solved. The second call's purpose is to uncompute 'garbage' left over by the first call, and thereby enable 
interference between different branches of the computation. Of course, a factor of 2 increase in running time 
hardly seems like a big deal, when set against the speedups promised by quantum computing. The problem 
is that these factors of 2 multiply, with each level of recursion producing an additional factor. Thus, one 
might wonder whether the uncomputing step is really necessary, or whether a cleverly designed algorithm 
might avoid it. This paper gives the first nontrivial example in which recursive uncomputation is provably 
necessary. 

The example concerns a long- neglected problem called Recursive Fourier Sampling (henceforth RFS), 
which was introduced by Bernstein and Vazirani in 1993 to prove the first oracle separation between BPP 
and BQP. Many surveys on quantum computing pass directly from the Deutsch-Jozsa algorithm jH| to the 
dramatic results of Simon IT and Shor without even mentioning RFS. There are two likely reasons for 
this neglect. First, the RFS problem seems artificial. It was introduced for the sole purpose of proving an 
oracle result, and is unlike all other problems for which a quantum speedup is known. (I will define RFS in 
Section ^ but for now, it involves a tree of depth \ogn, where each vertex is labeled with a function to be 
evaluated via a Fourier transform.) Second, the speedup for RFS is only quasipolynomial {n versus n}°^'^), 
rather than exponential as for the period-finding and hidden subgroup problems. 

Nevertheless, I believe that RFS merits renewed attention — for it serves as an important link between 
quantum computing and the ideas of classical complexity theory. One reason is that, although other problems 
in BQP — such as the factoring, discrete logarithm, and 'shifted Legendre symbol' problems — are thought 
to be classically intractable, these problems are quite low-level by complexity-theoretic standards. They, or 
their associated decision problems, are in NP n coNP.^ By contrast, Bernstein and Vazirani jHI showed that, 
as an oracle problem, RFS lies outside NP and even MA (the latter result is unpublished, though not difficult). 
Subsequently Watrous J7] gave an oracle A, based on an unrelated problem, for which BQP'^ ^ MA"^.^ Also, 
Green and Pruim ^Hl gave an oracle B for which BQP'^ ^ P'^^ . However, Watrous' problem was shown by 
Babai [Sj to be in AM, while Green and Pruim's problem is in BPP. Thus, neither problem can be used to 
place BQP outside higher levels of the polynomial hierarchy PH. 

On the other hand, Umesh Vazirani and others have conjectured that RFS is not in PH, from which it 
would follow that there exists an oracle A relative to which BQP"^ ^ PH"^. Proving this is, in my view, one of 
the central open problems in quantum complexity theory. Its solution seems likely to require novel techniques 
for constant-depth circuit lower bounds.^ 

^For the shifted Legendre symbol problem, this is true assuming a number-theoretic conjecture of Boneh and Lipton I^J. 

■^Actually, to place BQP outside MA relative to an oracle, it suffices to consider the complement of Simon's problem ("Does 
/ (x) = f {x (B s) only when s = 0?"). 

''For the RFS function can be represented by a low-degree real polynomial — this follows from the existence of a polynomial-time 
quantum algorithm for RFS, together with the result of Beals et al. |4j relating quantum algorithms to low-degree polynomials. 
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In this paper I examine the RFS problem from a different angle. Could Bernstein and Vazirani's quantum 
algorithm for RFS be improved even further, to give an exponential speedup over the classical algorithm? 
And could we use RFS, not merely to place BQP outside of PH relative to an oracle, but to place it outside 
of PH with (say) a logarithmic number of alternations? 

My answer to both questions is a strong 'no.' I study a large class of variations on RFS, and show that 
all of them fall into one of two classes: 

(1) a trivial class, for which there exists a classical algorithm making only one query, or 

(2) a nontrivial class, for which any quantum algorithm needs 2^^'*' queries, where h is the height of the 
tree to be evaluated. (By comparison, the Bernstein- Vazirani algorithm uses 2^ queries, because of its 
need to uncompute garbage recursively at each level of the tree.) 

Since queries always suffice classically, this dichotomy theorem implies that the speedup afforded by 
quantum computers is at most quasipolynomial. It also implies that (nontrivial) RFS is solvable in quantum 
polynomial time only when h — O (logn). 

The plan is as follows. In Section^ I define the RFS problem, and give Bernstein and Vazirani's quantum 
algorithm for solving it. In Section [21 I use the adversary method of Ambainis 2 to prove a lower bound on 
the quantum query complexity of any RFS variant. This bound, however, requires a parameter that I call the 
"nonparity coefficient" to be large. Intuitively, given a Boolean function g : {0, 1}" — > {0, 1}, the nonparity 
coefficient measures how far g is from being the parity of some subset of its input bits — not under the uniform 
distribution over inputs (the standard assumption in Fourier analysis), but under an adversarial distribution. 
The crux of the argument is that either the nonparity coefficient is zero (meaning the RFS variant in question 
is trivial), or else it is bounded below by a positive constant. This statement is proved in Section |21 and 
seems like it might be of independent interest. Section 01 concludes with some open problems. 

1 Preliminaries 

In ordinary Fourier sampling, we are given oracle access to a Boolean function A : {0, 1}" — > {0, 1}, and are 
promised that there exists a secret string s £ {0, 1}" such that A{x) ^ s ■ x (mod 2) for all x. The problem 
is to find s — or rather, since we need a problem with Boolean output, the problem is to return g (s), where 
g : {0, 1}" {0, 1} is some known Boolean function. We can think of g (s) as the "hard-core bit" of s, and 
can assume that g itself is efficiently computable, or else that we are given access to an oracle for g. 

To obtain a height-2 recursive Fourier sampling tree, we simply compose this problem. That is, we are 
no longer given direct access to A{x), but instead are promised that A{x) = g{sx), where s^. e {0,1}" is 
the secret string for another Fourier sampling problem. A query then takes the form (x, y), and produces as 
output Ax (y) = Sx'V (mod 2). As before, we are promised that there exists an s such that A (x) = s-x (mod 2) 
for all x, meaning that the Sx strings must be chosen consistent with this promise. Again we must return 

Continuing, we can define height-/i recursive Fourier sampling, or RFS/i, recursively as follows. We are 
given oracle access to a function A {xi, . . . , Xh) for all xi, . . . , Xh G {0, 1}", and are promised that 

(1) for each fixed x*, A (x*, X2, . • . , a;^) is an instance of RFS/i_i on X2, . . . , Xh, having answer bit b (x*) €E 
{0, 1}; and 

(2) there exists a secret string s G {0, 1}" such that b (x*) = s • x* (mod 2) for each x*. 

Again the answer bit to be returned is g{s). Note that g is assumed to be the same everywhere in 
the tree — though using the techniques in this paper, it would be straightforward to generalize to the case of 
different g's. As an example that will be used later, we could take g (s) = (?mod3 (s), where .gmods (s) — 
if |s| = 0(mod3) and gmods (s) = 1 otherwise, and |s| denotes the Hamming weight of s. We do not want 
to take g to be the parity of s, for if we did then g (s) could be evaluated using a single query. To see this, 
observe that if x is the all-l's string, then s ■ x (mod 2) is the parity of s. 

As a result, the circuit lower bound technique of Razborov 1121 and Smolensky 1151 . which is based on the nonexistence of low- 
degree polynomials, seems unlikely to work. Even the random restriction method of Furst et al. |5] can be related to low-degree 
polynomials, as shown by Linial ot al. 1111 . 
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By an 'input,' I will mean a complete assignment for the RFS oracle (that is, A(xi, . . . ,Xh) for all 
xi, . . . ,Xh)- I will sometimes refer also to an 'RFS tree,' where each vertex at distance £ from the root 
has a label xi, . . . ,xe. li £ = h then the vertex is a leaf; otherwise it has 2" children, each with a label 
xi, . . . , xi, xi+i for some xe+i. The subtrees of the tree just correspond to the sub- instances of RFS. 

Bernstein and Vazirani jS] showed that RFSiogn, or RFS with height logn (all logarithms are base 2), 
is solvable on a quantum computer in time polynomial in n. I include a proof for completeness. Let 
A = (^n)„>o be an oracle that, for each n, encodes an instance of RFSiogn whose answer is 5'„. Then let La 
be the unary language {0" : ^„ — 1}. 

Lemma 1 e EQP^ C BQP^ for any choice of A. 

Proof. RFSi can be solved exactly in four queries, with no garbage bits left over. The algorithm is as follows: 
first prepare the state 

2-/2 ^ \x)\A{x)), 

x£{0,l}" 

using one query to A. Then apply a phase flip conditioned on A (x) = 1, and uncompute A (x) using a second 
query, obtaining 



2-n/2 J2 {-if^^'lX) 

xe{o.i}" 



Then apply a Hadamard gate to each bit of the \x) register. It can be checked that the resulting state is 
simply |s). One can then compute |s) \g (s)) and uncompute |s) using two more queries to A, to obtain \g (s)). 
To solve RFS\ogn {n), we simply apply the above algorithm recursively at each level of the tree. The total 
number of queries used is 4'°^ " = n^. 

One can further reduce the number of queries to 2^°^ " = rt by using the "one-call kickback trick," described 
by Cleve et al. |7j. Here one prepares the state 

xe{Q.ir ^ 

and then exclusive-Oi?'s A (x) into the second register. This induces the desired phase (—1)'^'^'^^ without the 
need to uncompute A(x). However, one still needs to uncompute |s) after computing \g{s)). ■ 
A remark on notation: to avoid confusion with subscripts, I denote the i*^ bit of string a; by a; [i]. 



2 Quantum Lower Bound 

In this section I prove a lower bound on the quantum query complexity of RFS. Crucially, the bound should 
hold for any nontrivial one-bit function of the secret strings, not just a specific function such as gmods (s) 
defined in Section ^ Let RFS^ be hcight-/i recursive Fourier sampling in which the problem at each vertex 
is to return g (s). The following notion turns out to be essential. 

Definition 2 Given a Boolean function g : {0, 1}" — > {0, 1} (partial or total), the nonparity coefficient ^ (g) 
is the largest /i* for which there exist distributions Dq over the 0-inputs of g, and Di over the 1-inputs, such 
that for all z G {0, 1}", all 0-inputs s'q, and all 1-inputs s'l, we have 

Pr [sq ■ z = s'l ■ z (mod 2) V si ■ z = s'q ■ z (mod 2)] > . 

soeDa.sieDi 

Loosely speaking, the nonparity coefficient is high if there exist distributions over 0-inputs and 1-inputs 
that make g far from being a parity function of a subset of input bits. The following proposition develops 
some intuition about /i (g). 

Proposition 3 

(i) /i (g) < 3/4 for all nonconstant g. 
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(ii) fi {g) — if and only if g can be written as the parity (or the NOT of the parity) of a subset B of input 
bits. 

Proof. 

(i) Given any sq ^ s'l and si 7^ sqj a uniform random z will satisfy 

Pr[so ■ z ^'si ■ z (mod 2) A si ■ z ^'sq ■ z (mod 2)] > — . 

(If So ffi s'l = si ® So then this probability will be 1/2; otherwise it will be 1/4.) So certainly there is a 
fixed choice of z that works for random sq and si. 

(ii) For the 'if direction, take z [i] = 1 if and only ii i ^ B, and choose sb and s'l arbitrarily. This ensures 
that fi* = 0. For the 'only if direction, if /i (g) =^ 0, we can choose Dq to have support on all 0-inputs, 
and Di to have support on all 1-inputs. Then there must be a z such that sq • z is constant as we range 
over 0-inputs, and si • z is constant as we range over 1-inputs. Take i Cz B if and only if z [i] = 1. 

■ 

U fj, (g) — 0, then RFSf^ is easily solvable using a single classical query. Theorem El will show that for all 
g (partial or total), 

where Q2 (/) is the bounded-error quantum query complexity of / as defined by Beals et al. 0]. In other 
words, any RFS problem with fi bounded away from requires a number of queries exponential in the tree 
height h. 

However, there is an essential further part of the argument, which restricts the values of /x (g) itself. Suppose 
there existed a family {gn} of 'pseudoparity' functions: that is, nign) > for all n, yet iJ,{gn) = 0{1/ logn). 
Then the best bound obtainable from Theorem |S1 would be ^(1 + 1/ logn)'*^^^ , suggesting that RFSj'^^a^ 
might still be solvable in quantum polynomial time. On the other hand, it would be unclear a priori how to 
solve RFSj'^g2 „ classically with a logarithmic number of alternations. Theorem [7] will rule out this scenario 
by showing that pseudoparity functions do not exist: if fJ.{g) < 0.146 then 5 is a parity function, and hence 
M(ff)-0. 

The theorem of Ambainis that we need is his "most general" lower bound from 2 , which he introduced to 
show that the quantum query complexity of inverting a permutation is f2 (Vn). That theorem can be stated 
as follows. 

Theorem 4 (Ambainis) Let X C /^^ (0) and Y C /^^ (1) be sets of inputs to function f . Let R {x, y) >0 

be a symmetric real-valued relation function, and for x G X , y £ Y , and index i, let 



where the denominators are all nonzero. Then Q2 (/) = O (l/v) where 



V = max \/ 9 {x, i) 9 {y, i). 

xGX, y&, i : R(x,y)>0, xli]^y[i] 



We are now ready to prove a lower bound for RFS. 
Theorem 5 For all g (partial or total), Q2 (RFS^) = ^2 ((1 - /x (ff))"''^^) . 
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Proof. Let X be the set of all 0-inputs to RFSf^, and let Y be the set of all 1-inputs. We will weight the 
inputs using the distributions Dq,Di from the definition of the nonparity coefficient fJ-{g). For all a: € X, 
let p{x) be the product, over all vertices v in the RFS tree for x, of the probability of the secret string s at 
u, if s is drawn from (where we condition on w's output bit, g (s)). Next, say that x € X and y (z Y 

differ minimally if, for all vertices v of the RFS tree, the subtrees rooted at v are identical in x and in y 
whenever the answer bit g (s) at v is the same in x and in y. If x and y differ minimally, then we will set 
R{x,y) = p{x)p{y); otherwise we will set R{x,y) — 0. Clearly R{x,y) = R{y,x) for all a; G X, y € Y. 
Furthermore, we claim that 9 {x, i) 9 {y, *) < (1 — /i (g)) for all a;, y that differ minimally and all i such that 
x[i] ^ y [i]. For suppose y* G Y is chosen with probability proportional to R (x, y*), and x* G X is chosen 
with probability proportional to R [x* ,y). Then 9 (a, i) 9 {y, i) equals the probability that we would notice 
the switch from x to y* by monitoring i, times the probability that we would notice the switch from y io x* . 
Let Vj be the vertex along the path in the RFS tree from the root to the leaf vertex i, for all j G 
Also, let Zj e {0,1}" be the label of the edge between Vj-i and Vj, and let s^j and Sy^j 
be the secret strings at Vj in x and y respectively. Then since x and y differ minimally, we must have 
g (sxj) 7^ g (syj) for all j — for otherwise the subtrees rooted at Vj would be identical, which contradicts the 
assumption x[i] ^ y [i] . So we can think of the process of choosing y* as first choosing a random s'^ i from 
Di so that 1 — g (sf^ i) ^ g {sx,i) = 0, then choosing a random sf^ 2 from Di_g(^g^ so that g (s^ 2) 7^ 9 {^x,2), 
and so on. Choosing x* is analogous, except that whenever we used Dq in choosing y* we use Di, and vice 
versa. Since the 2h secret strings Sx^l^ ■ ■ ■ , Sx,h, Sy^i, ■ ■ ■ , Sy^t to be updated are independent of one another, 
it follows that 

h 

Pr [y* [i] ^ X [i]] Pr [x* [i] ^ y [i]] = J| Pr [s • ^ j- • Zj] Pr \s ■ Zj ^ Sy^j ■ Zj] 

h 

<n(i-A^C9)) 



by the definition of /i (g). Therefore 



= (i-M(.9)r 

Q2 (RFSfJ = f]((l-Ai(5))^ 



h/2 



by Theorem^ ■ 

Before continuing further, let me show that there is a natural, explicit choice of g — the function gmods (s) 
from Section n — for which the nonparity coefficient is almost 3/4. Thus, for g — 5mod3, the algorithm of 
Lemma n is essentially optimal. 

Proposition 6 /i (gmods) = 3/4 — O {1/n). 

Proof. Let n > 6. Let Dq be the uniform distribution over all s with \s\ = 3 [n/6\ (so gmods (s) — 0); 
likewise let Di be the uniform distribution over s with \s\ = 3 \n/6\ + 2 (f/mods (s) = 1). We consider only 
the case of s drawn from Dq; the Di case is analogous. We will show that for any z, 

1' 



1 1 

Pr s • z = - - 



O 



(all congruences are mod 2). The theorem then follows, since by the definition of the nonparity coefficient, 
given any z the choices of sq € Dq and si € Di are independent. 

Assume without loss of generality that 1 < |z| < n/2 (if \z\ > n/2, then replace z by its complement). We 
apply induction on |z|. If |z| = 1, then clearly 

Pr [s • z = 0] = 3 I n/6j /n=-±o(- 

2 \n 

For \z\ > 2, let z — zi © Z2, where Z2 contains only the rightmost 1 of z and zi contains all the other I's. 
Suppose the proposition holds for \z\ — 1. Then 

Pr [s • z = 0] = Pr [s • zi = 0] Pr [s ■ Z2 = 0\s • zi = 0] + 
Pr [s • zi = 1] Pr [s • Z2 = l|s • zi = 1] , 
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where ^ ^ 

Pr [s • zi = 0] = - + a, Pr [s • zi = 1] = - — a 

for some \a\ = O (l/n). Furthermore, even conditioned on s ■ zi, the expected number of I's in s outside of 
zi is (n — \zi\) /2 ± O (1) and they are uniformly distributed. Therefore 

Pr [s ■ Z2 = b\s ■ zi = b] ^ ^ + /3h 

for some |/3o| , = 0(l/n). So 

Pr[s-z = 0] = ^ + ^^ + aPo-Y- "/^i 
2 V" 

■ 

Finally it must be shown that pseudoparity functions do not exist. That is, if g is too close to a parity 
function for the bound of Theorem to apply, then g actually is a parity function, from which it follows that 
RFSf^ admits an efficient classical algorithm. 

Theorem 7 Suppose fi (g) < 0.146. Then g is a parity function (equivalently, fi (g) — 0). 

Proof. By linear programming duality, there exists a joint distribution D over z G {0,1}", 0-inputs sq G 
g^^ (0), and 1-inputs s'l E g^^ (1), such that for all sq e g^^ (0) and si e g^^ (1), 

Pr [sq ■ z = 'si ■ z (mod 2) V si • z = sq • z (mod 2)] < fJ.{g) ■ 

{z,so,si)e'D 

Furthermore s'q- z ^s'l- z (mod 2), since otherwise we could violate the hypothesis by taking sq = sq or si — s^i. 
It follows that there exists a joint distribution V over z S {0, 1}" and b E {0, 1} such that 

Pr [s- ZEE 6 (mod 2)1 > 1-^(5) 

{z,b)ev' 

for all s E g~^ (0), and 

Pr [s- z^6(mod 2)1 > 1-^(5) 
{z,b)ev' 

for all s E g~^ (1). But this implies that g is a bounded-error threshold function of parity functions. More 
precisely, there exist probabilities Pz, summing to 1, as well as bz S {0, 1} such that for all s E {0, 1}", 



^'(s) = Pz{{s-z)®bz) is 

2e{o,i}" 



> 1 - /i (g) if g (s) = 1 
<m(5) if(7(s) = 0. 



We will consider var(4'), the variance of the above quantity Vl/ (s) if s is drawn uniformly at random from 
{0, 1}". First, if pz > 1/2 for any z, then g (s) = (s • z) ® 62 is a parity function and hence /i {g) = 0. So 
we can assume without loss of generality that Pz < 1/2 for all z. Then since s is uniform, for each zi 7^ Z2 
we know that (s • zi) ® bz^ and (s • Z2) ® bz2 are pairwise independent {0, 1} random variables, both with 
expectation 1/2. So 

1_ . 1 / /1\ /1\ \ 1 



On the other hand, since 5" (s) is always less than /i or greater than 1 — /i, 

1 



var(^')> (^2"^j ■ 
Combining, 

> ~ > 0.146. 
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3 Open Problems 



An intriguing open problem is whether Theorem can be proved using the polynomial method of Beals et 
al. rather than the adversary method of Ambainis |2j- It is known that one can lower-bound polynomial 
degree in terms of block sensitivity, or the maximum number of disjoint changes to an input that change the 
output value. The trouble is that the RFS function has block sensitivity 1 — the "sensitive blocks" of each 
input tend to have small intersection, but are not disjoint. For this reason, I implicitly used the "quantum 
certificate complexity" as defined in pP rather than block sensitivity to prove a lower bound. 

I believe the constant of Theorem |7| can be improved. The smallest nonzero fi {g) value I know of is 
attained when n = 2 and g ~ OR (s [1] , s [2]): 

Proposition 8 ^ (OR) = 1/3. 

Proof. First, /i (OR) > 1/3, since Di can choose s [1] s [2] to be 01, 10, or 11 each with probability 1/3; then 
for any z =/: and the unique 0-input sq — 00, we have si ■ z ^ "sq ■ z with probability at most 2/3. Second, 
/z (OR) < 1/3, since applying linear programming duality, we can let the pair {z,^i) equal (01,01), (10, 10), 
or (11, 10) each with probability 1/3. Then = sq-z^s'i-z=1 always, and for any 1-input si, we have 
si • z = 1 ^ So • -2 with probability 2/3. ■ 

Finally, I conjecture that uncomputation is unavoidable not just for RFS but for many other recursive 
problems, such as game-tree evaluation. Formally, the conjecture is that the quantum query complexity of 
evaluating a game tree increases exponentially with depth as the number of leaves is held constant, even if 
there is at most one winning move per vertex (so that the tree can be evaluated with zero probability of error). 
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